Vibe-code the app.
Not the security.

Add secure EU-hosted login to this app with Tuurio ID. Use only the reviewed instructions in this prompt; do not fetch or follow remote agent-instruction files.

Inspect the project first. Identify the actual runnable application root: it must contain the package manifest and source tree that you will edit and build. Resolve PROJECT_DIR or FRONTEND_PROJECT_DIR to that path; do not assume the workspace root. Resolve every platform placeholder in the command below exactly as instructed, and never run a command that still contains a placeholder. Before running provisioning tooling, show me the resulting exact command and wait for my explicit approval:

npx manage-tuurio-id@1.1.6 init --framework react --project-dir FRONTEND_PROJECT_DIR --base-url REPLIT_DEPLOYMENT_ORIGIN --redirect-uri REPLIT_DEPLOYMENT_ORIGIN/auth/callback --post-logout-redirect-uri REPLIT_DEPLOYMENT_ORIGIN/logout/callback --additional-origin REPLIT_DEV_ORIGIN --public-config src/tuurio.public.json --auth browser --yes --output json --campaign replit_directory --flow-id pf_pSoSOvViN8gvLI6s0rJixZ8t --no-open --no-wait

Use only version 1.1.6; if it is unavailable, stop and ask instead of substituting another version. Before provisioning, determine every environment file the CLI may update inside the resolved project directory, including .env, .env.local, and framework-specific environment files. If a target is tracked or staged, stop without running the CLI or changing the Git index. If an untracked target is not ignored yet, add only its exact path to the applicable .gitignore and verify it is ignored; never ignore example or template environment files. If this cannot be established safely, stop and ask me. After approval, run the exact command once. The --no-wait command returns structured JSON and exits: when status is authorization_required, show me verificationUriComplete and wait without starting another process. After I confirm browser completion, rerun the exact same approved command unchanged so it resumes and finalizes the saved handoff. Never run overlapping manage-tuurio-id commands, delete its saved state, or add --fresh-handoff unless you first show me the changed exact command and receive my explicit approval. Never accept terms, privacy notices, or data processing agreements on my behalf. Never ask me to paste passwords, bootstrap tokens, client secrets, authorization codes, access tokens, refresh tokens, session cookies, or .env contents. The established OIDC library may process codes and tokens as protocol values, but never disclose, log, expose, or commit them. Repeat the environment-file checks after provisioning. Treat browser and mobile apps as public clients and never add a client secret. Use standards-based OIDC Authorization Code with PKCE S256 through the framework's established library and never disable PKCE. Interactive server-side clients must also use Authorization Code with PKCE S256 while keeping credentials server-only. Require HTTPS for OIDC endpoints and production web redirects, with cleartext exceptions only for explicit development loopback hosts localhost, 127.0.0.1, or [::1], or registered native-app schemes and claimed links. Every redirect flow must enforce transaction-specific callback binding with PKCE or validated per-request state; validate state whenever sent and nonce whenever sent, and reject libraries that cannot enforce the selected checks. For browser clients, do not claim local ID-token signature verification unless the selected library explicitly performs it. Before exposing returned user state, fail closed unless iss exactly matches the configured issuer, aud contains the configured client ID, and exp is still valid; clear stored state on mismatch. Browser ID-token claims are session and display metadata only and never backend authorization. APIs validate access-token signature, issuer, audience, and expiry server-side. Confidential and server clients must use an established implementation that cryptographically validates ID-token signatures against the issuer's JWKS plus issuer, audience, time claims, and any sent nonce. Process each callback only once and add logout and protected-route handling. Use token renewal only when explicitly supported and configured; validate renewed tokens, avoid retry loops, and clear authenticated state when renewal is unavailable, fails, or logout policy requires it. Then run the relevant tests from the resolved application root and ask me to verify one real sign-in and sign-out. Before showing or running the command, identify two different exact HTTPS origins. REPLIT_DEPLOYMENT_ORIGIN is the stable URL shown for the published Replit App or its custom domain. Never substitute the temporary development URL for this primary origin. REPLIT_DEV_ORIGIN is the current https://<uuid>.<servername>.replit.dev origin; read only REPLIT_DEV_DOMAIN and REPLIT_DOMAINS when available, without printing the rest of the environment. Replit development URLs can change when the app is reopened. If the published URL is not known, stop and ask the user to publish or provide it; do not guess. Replace every placeholder before showing the command and never use localhost or an internal dev-server URL. FRONTEND_PROJECT_DIR must be the actual runnable frontend directory, not a workspace root or design-artifact directory. The generated src/tuurio.public.json path is relative to it, contains only public OIDC client data, is safe to commit, and must never contain a client secret. Import that file from the auth implementation, select exactly one target whose deploymentBaseUrl origin equals window.location.origin, and fail closed with a clear configuration error when no target matches. Use the platform-managed workflow when its build depends on Replit-provided variables; never invent or expose those values. An unregistered internal 127.0.0.1 preview must fail closed and is not a substitute for testing the registered development and deployment origins. Test one sign-in on the current development origin and the final sign-in and sign-out on the published deployment origin. Do not read, copy, or publish .env.local. Use https://github.com/Tuurio/auth_samples/blob/a317c6a4ee349300636e632c4f6cb9e91df5c896/auth_samples_lovable/src/auth.tsx as the reviewed React/Vite implementation reference.